CVE-2025-55211mediumCWE-78

CVE-2025-55211: falha de média gravidade em FreePBX framework

FreePBX Post-Authenticated Command Injection

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar framework

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 0.4%
FreePBX is an open-source web-based graphical user interface. From 17.0.19.11 to before 17.0.21, authenticated users of the Administrator Control Panel (ACP) can run arbitrary shell commands by maliciously changing languages of the framework module. This vulnerability is fixed in 17.0.21.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:L/U:Green
Produtos afetados
FreePBX · framework
CVEs relacionadas — FreePBX framework

No mesmo produto, das mais perigosas para as menos.

CVE-2025-66039CRITICALFreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth HeaderEPSS 3.4%CVE-2025-59056MEDIUMFreePBX vulnerable to unauthenticated Denial of ServiceEPSS 0.5%CVE-2026-73661HIGHFreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted BackupEPSS 0.3%CVE-2025-67722MEDIUMAuthenticated amportal search for ‘freepbx_engine’ in non root writeable directories leads to potential privilege escalationEPSS 0.1%